[sangupta]

Contact the site and give them a time-frame by when they should comply. Politely ask them to comply telling them otherwise you would disclose the site's identity. Also, try and contact security research organizations to notify them of the vulnerability. This would add a little extra pressure on the site's owner to fix the security hole.

My 2 cents.

[nnash]

I don't think an ultimatum would help facilitate the issue being addressed more quickly; I do agree with the latter approach though.

[tagada]

No, you're right ...

Not an ultimatum. Just do it.

Notify it to all important media in tech world. They will take care of that.

[dsl]

I'm still trying to get anyone to care that vmware.com and a few other sites are doing it.